Vulnerabilitymedium
New Sofacy Attacks Against US Government Agency
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-1641 | Memory Corruption RCE in Microsoft Office via Malicious RTF Files | — | 97% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | munimonoce.com | analysis of those payloads revealed one primary C2 domain, munimonoce[.]com, and three secondary C2 domains, www.wscapi[.]com, www.ta |
| domain | servicecdp.com | Prevenity appeared to only have a single primary C2 domain, servicecdp[.]com. This domain also appears to be newly created for this sp |
| domain | storsvc.org | ondary C2 domains, www.wscapi[.]com, www.tabsync[.]net, and storsvc[.]org. The secondary C2 domains may appear familiar, as they we |
| domain | tabsync.net | ]com, and three secondary C2 domains, www.wscapi[.]com, www.tabsync[.]net, and storsvc[.]org. The secondary C2 domains may appear f |
| domain | wscapi.com | main, munimonoce[.]com, and three secondary C2 domains, www.wscapi[.]com, www.tabsync[.]net, and storsvc[.]org. The secondary C2 d |
| ipv4 | 191.101.31.6 | ill send network beacons to, specifically “google.com” and “191.101.31.6”. These beacons are sent to the legitimate website google.c |
| ipv4 | 66.172.11.207 | 2 domain munimonoce[.]com previously had resolved to the IP 66.172.11.207, which was previously identified as a primary C2 IP for a S |
| sha256 | 03cb76bdc619fac422d2b954adfa511e7ecabc106adce804b1834581b5913bca | ve been created SofacyCarberp Indicators Delivery Documents 03cb76bdc619fac422d2b954adfa511e7ecabc106adce804b1834581b5913bca (Exercise_Noble_Partner_16.rtf) 12572c2fc2b0298ffd4305ca532 |
| sha256 | 12572c2fc2b0298ffd4305ca532317dc8b97ddfd0a05671066fe594997ec38f5 | c106adce804b1834581b5913bca (Exercise_Noble_Partner_16.rtf) 12572c2fc2b0298ffd4305ca532317dc8b97ddfd0a05671066fe594997ec38f5 (Putin_Is_Being_Pushed_to_Prepare_for_War.rtf and Russian a |
| sha256 | 57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b | a854130c652dcc6d29b203ee230ce0603c83d9f11bbcacc (iprpp.dll) 57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b (clconfg.dll) Command and Control 191.101.31.6 munimonoce[. |
| sha256 | 69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261 | 097a46e08f48b971570ef4667fbfd6b7301 (amdcache.dll) Payloads 69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261 (svchost.dll) aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17 |
| sha256 | aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632 | fcefe6de92a16ed474bbdff3288498851afc12a834261 (svchost.dll) aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632 (clconfg.dll) dfa8a85e26c07a348a854130c652dcc6d29b203ee230c |
| sha256 | be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0 | b952503a2e6f016356e02ee31dea36c713141d4f3785 (btecache.dll) be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0 (bitsprex3.dll) fbd5c2cf1c1f17402cc313fe3266b097a46e08f48b9 |
| sha256 | c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785 | or_War.rtf and Russian anti-Nato troops.rtf) Loader Trojans c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785 (btecache.dll) be1cfa10fcf2668ae01b98579b345ebe87dab77b6b15 |
| sha256 | dfa8a85e26c07a348a854130c652dcc6d29b203ee230ce0603c83d9f11bbcacc | f67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632 (clconfg.dll) dfa8a85e26c07a348a854130c652dcc6d29b203ee230ce0603c83d9f11bbcacc (iprpp.dll) 57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc |
| sha256 | fbd5c2cf1c1f17402cc313fe3266b097a46e08f48b971570ef4667fbfd6b7301 | 8579b345ebe87dab77b6b1581c368d1aba9fd2f10a0 (bitsprex3.dll) fbd5c2cf1c1f17402cc313fe3266b097a46e08f48b971570ef4667fbfd6b7301 (amdcache.dll) Payloads 69940a20ab9abb31a03fcefe6de92a16ed4 |
From the original article
7 min read at unit42.paloaltonetworks.comThe Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted the United States government.
By Bryan Lee · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.